CVE-2025-27740: high-severity vulnerability in Microsoft Windows Server 2008 R2 Service Pack 1
Active Directory Certificate Services Elevation of Privilege Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A weakness in Windows Active Directory Certificate Services allows someone with basic access to gain higher privileges on the network. This is dangerous because it lets attackers move from limited accounts to powerful ones.
CWE-1390 weak authentication flaw in AD Certificate Services permits privilege escalation via network-based attack requiring prior authorization. Exploitation enables authenticated attackers to obtain elevated privileges within the domain, affecting confidentiality, integrity, and availability of directory services.
In the same product, most dangerous first.